17 May 2024

Japanese Navy fleet broadcast, a review of the "Japanese Slot Machine" (I)

Japanese Maritime Self-Defence Forces (JMSDF) HF Fleet Broadcast, also known as the "Japanese Slot Machine", heard with data payloads on 8312.50 KHz/USB using a remote KiwiSDR located in Azumino-city, Nagano Japan [1]. This signal has the Enigma designation "xsl" but I honestly don't understand why it was placed among the "mysterious signals" or even among the number stations: probably due to its characteristic idling refrain because it is nothing more than a fleet broadcast as well as the continuous and uninterrupted STANAG-4285 transmissions. 

The waveform is composed of the idle phase and the traffic/data phase. 


The data waveform occupies a 2 KHz bandwidth and use a 1500 Hz sub-carrier which is QPSK modulated at the symbol rate of 1500 Baud (Figure 1). 

Fig. 1 - QPSK parameters of the data waveform

The signal has strong ACF spikes every 93.33 ms (Figure 2) that, at the speed of 1500 Bd, correspond to a frame of 140 dibit symbols in length (frame rate of 10.71 Hz).

Fig. 2 - autocorrelation spikes and relative bitmap (data waveform)

The demodulated bitstream in Figure 3 shows a framing consisting of a probe/sync aimed "preamble" sequence (ps) of 28 known symbols (56 bits) in length followed by 112 unknown symbols representing the transferred data

[10001010001000100000001010100010101010100000100000101000]

Fig. 3 - 140 QPSK symbols (28 + 112) frame structure

Looking at the representation of the QPSK symbols of a frame (Figure 4) you can see that the 28 symbols of the preamble sequence are PSK2 modulated and then mapped to dibit symbols.

Fig. 4 - graphic rapresentation of a 140-symbol frame

The confirmation comes from the examination of the second degree harmonics in Figure 5 where the PSK2 modulation of the subcarrier can be clearly distinguished for a duration of 18.66 ms corresponding to 28 symbols at the keying speed of 1500 Baud. Also note the accentuated PSK transitions in the phase diagram.

Fig. 5 - PSK2 modulations

Data symbols have a flat autocorrelation indicating a (convolutional?) coding other than interleaving and encryption: bit distribution and Shannon entrophy graphs are good clues.

Fig. 6 - bit distribution and Shannon entropy of the data symbols

The idle waveform too is QPSK modulated at a symbol rate of 1500 baud but has a complex framing which to some extent follows the traffic waveform. As in the traffic waveform, the framing consists of repetions of 140 symbols/93.33 ms frames which generate the distinctive audio refrain (Figure 7).

Fig. 7 - idle phase signal

The underlying clicks audible during the idle phase have a frequency of 11.5 Hz and corresponds to the 140-symbol frames (Figure 8).

Fig. 8 - 11.5 Hz ticks

The autocorrelation of the idle signal (Figure 9) shows strong 5973 ms spikes grouping the lower 93.33 ms spikes; since the 1500 Bd keying speed, from a simple calculation the 5973 ms ACF results as a group of 64 frames each of 140 symbols: the 64 frames sequence is here designated as "superframe" and it exactly lasts as the refrain.  

Fig. 9 - autocorrelation spikes and relative bitmap (idle waveform)

The superframe structure is visible in the demodulated bitstream once reshaped to 140 symbols (280 bits) in order to highlight the 64 component frames: it's worth noting the presence of the same 28 symbols preamble sequence seen in the demodulated data bitstream (Figs 10, 3). Since the preambles are repeated in all frames, they are the cause of the underlying clickings mentioned above.

Fig. 10 - idle waveform, superframe structure

After the removal of the preamble sequence, it's easy to see that the remaining 112 symbols of the superframes are formed of four 28-symbols blocks, each block consisting of the same patterns (Figure 11).

Fig. 11

After having isolated a single block I identified eleven patterns (designated here as p01 - p11) which are repeated in various ways within it (Figure 12). 

☆ Please notice that: ☆

1) the "designations" I used here are only mine and are introduced just for convenient reference.

2) the repeated patterns p01-p11 are numbered in the order of their appearance within a frame (the first pattern is the one following the preamble)

3) the choice of which frame in the superframe should be designated as the first one is arbitrary (superframe boundaries may be seen as a fixed-width 64-frame sliding window)

4) I chose the carrier reference phase such that the probe/sync preamble is

[10001010001000100000001010100010101010100000100000101000]

another arbitrary carrier phase reference could be chosen and then the resulting patterns will differ: therefore the values of the patterns in Figure 11 are not to be understood here as "absolute"

Fig. 12 -  repeated patterns

The repeated patterns are indicated in Table I: note that the pattern p01 is composed of 28 symbols of the same phase and therefore generates a single tone as well as the pattern p06 does, being in counter-phase with respect to p01 (180° far).

Table I

 The superframe is then described as in Table II.

Table II

Patterns p02 and p05 seem to play a particular role: in the first 44 frames looks like they are used as "separators" between three frames of same value (redundancy?) while they are used exclusively - and grouped - in the remaining 20 frames. Most likely the long duration of the idle phase provides a strong channel probing and frame/time synchronization for the receive modems. It's worth noting that the duration of the data phase is a multiple of the duration of the idle superframe, e.g. 7 times in the sample shown in Figure 13. 

Fig. 13

A "hybrid" superframe is sometimes transmitted alone or immediately before/after data superframes and consists of a mix of 16 QPSK data inserts and repeating patterns - that's why I called it "hybrid" (Figure 14).

Fig. 14 - hybrid superframe

 Frames 16 and 17 are joined in case two hybrid superframes are transmitted consecutively (Figure 15)

Fig. 15 - two hybrid superframes transmitted consecutively

The demodulated bitstream of a hybrid superframe shows the expected framing: that is, the usual preamble of 28 symbols followed by four blocks, each of 28 symbols (Figure 16).

Fig. 16 - demodulated bitstream of the hybrid superframe

The 28-symbol reshaped bitstream (after removing the preamble sequence) clearly shows the 16 QPSK data inserts separated by the two patterns hp01 and hp02

[11000000001010101011000000001010101011000000001010101011]
[01101010100000000001101010100000000001101010100000000001]

Fig. 17 - 28-symbol reshaped demodulated bitstream of the hybrid superframe

While idle superframes are most likely used for channel probing and frame/time synchronization, the purpose of hybrid superframes is unclear as they also carry coded information.

As said above, the choice of a different carrier phase reference will obviously produce different values of the patterns. So, since that:
- the preamble sequence is PSK2 modulated (Figs 4,5)
- the phase offsets between preamble and patterns symbols shall be preserved
according to the choice of the carrier phase reference and relative mappings we'll get four different preamble sequences and thus four different "sets" of the eleven patterns p01-p11... but the same "formal" scheme as Table II will always be obtained. The same goes for hp01-hp02 patterns of the hybrid superframe.

Table III

The frames structure that is used for the idle and data/traffic waveforms is shown in Figure 18, a possible functional block diagram of the modem is illustrated in Figure 19. When switch S is in positions 2-1 the data phase is selected, positions 2-3 are used for the idle phase, positions 2-4 are used for the hybrid superframes. The presence of the interleaver & Gray decoder block is a my guess.

Fig. 18 - Frame structure for "Slot Machine" idle and traffic/data waveforms


Fig. 19 - "Slot Machine" (possible) functional block diagram

 

Direction Finding tries (TDoA algorithm) pinpoint the Ichihara transmitting station as the source of the signal [2]. 

Fig. 20 - direction finding results

The Ichihara transmitting station occupies an extensive area next to a golf course in Ichihara City. It has a microwave tower with four dishes, a large HF inverted conical array, strung between six tall masts, a mast with HF and VHF vertically polarised inverted conical monopoles, two HF rhombic antennas, two large horizontal HF/VHF log-periodic antennas, and a large horizontal curtain antenna [3].

Fig. 21 - Ichihara transmitting station (by google earth image)

Fig. 22 - Ichihara transmitting station antennas (by google street view)

A question still remains unanswered: why did JMSDF engineers design such a complex, though easily recognizable, idle waveform?

https://disk.yandex.com/d/suGK1GjRDEuX6Q
https://disk.yandex.com/d/qd4Cjj-YptLepg (Ichihara, file KML)


[1] http://jf0fumkiwi.ddns.net:8073/
[2] https://www.mod.go.jp/en/presiding/law/sdf.html
[3] https://www.jstor.org/stable/j.ctt13wwvvt.12

4 May 2024

Akula always reserves surprises...

A few days ago a friend of mine sent me some recordings of a serie of FSK bursts which had the same keying speed and shift (500Bd/1000Hz) as the "Akula" waveform but which differed due to the lack of the sync and preamble sequences as well as the IVs, as shown in Figure 1.

Fig. 1

The demodulation of these bursts, however, reserved a surprise: although the sync and preamble groups were missing, the EOM + EOT groups (101111 100010 100010 101111 011110) were exactly the same as Akula (see Figure 2).

Fig. 2 - some of the demodulated bitstreams

There and then I gave up and thought of a common EOM + EOT sequences perhaps also used in other CIS waveforms, until this morning I accidentally came across an Akula traffic on 8284.0 KHz (cf)... and I found a burst with the same characteristics, i.e. without the usual sync-preamble-IVs groups, among other "complete" bursts (1): say a kind of  Akula "data-only" burst (Figure 3). I had ever seen it before. 


Fig. 3 - a so-called Akula "data-only" burst
 

Could it be the same "physical" (possibly faulty) modem? Difficult to say. My friend's recordings date back to April 30th (three days ago) and made using a remote KiwiSDR in Azumino-city, Nagano Japan and therefore probably a vessel on-going in the Pacific Ocean; my recordings were made using an AirSpy server located in Tofta, Goland Is. Sweden and with an excellent SNR value: a clue of a vessel on-going in nearby waters. And yes, one could object that the propagation takes strange paths, and that's ok, but assuming the same area of origin of the signal (and thus the same vessel/modem), my listening would be quite unlikely given the time and the used frequency (Figure 4).

Fig. 4 - VOACAP chart

 
Among other things, the durations of the Akula transmissions recorded in Japan are unusual compared to those we are used to seeing, i.e. just short transmissions consisting of a few bursts likely to avoid triangulation by the "foe".

The question remains: faulty modems? a mode of Akula messaging that I don't know or have never met? or just mere coincidences or wrong receiver settings (ie AGC)?
Further successful registrations will (hopefully) help...

 
(1) As said, the other bursts of my recorded transmission have the Akula well-known format (1), ie:
- sync group (6 code words: 4x100101 + 2x110001) followed by 6-bit "0"s separator
- preamble group (7 code words arranged as: 4x1st code word + 3x2nd code word)
- data
- End-Of-Message group + EOT group (five code words: 101111 100010 100010 101111 011110) 
 

    









27 April 2024

a difficult signal

Sometimes it may happens to come across signals for which - unless of know it a priori - it is difficult to correctly define the used modulation;  it's the case of the so-called "semi-modes", where some FSK modulations at certain conditions have the shape of phase manipulation just because such signals possessing both PSK and FSK issues. Such "dualism" is spread enough and concerns tightly connected modulations as (G)MSK and OQPSK as well as CPFSK and SDPSK. A signal sent me by a friend of mine just falls into this category.
Let's get some parameters of the signal such as bandwidth (Bw), baud rate (Br), and shift (Sh): as from Figure 1

Bw = 19000 Hz
Br = 16000 Bd
Sh =  8000 Hz

Fig. 1 - main parameters of the signal

Looking at Figure 2, from "Signals Analyzer - radioscanner.ru" [1], MSK modulation has a bandwidth of about 1.5*Br, GMSK Bw is lesser than this value (in it’s limit is very close to theoretical Br), and SDPSK Bw is more than 1.5*Br. Well, this signal has the value of Sh exactly = Br/2 while Bw is < 1.5*Br: so, judging by these results, it could be a GMSK signal.

Fig. 2 - difference between MSK and GMSK

Another specific feature of the so-called "semi-modes" is the spectrum of their second harmonic: looking at Figure 3, the second harmonic has two very clear and defined lines and the spacing between these lines is equal to Br. As from [1], this is the necessary condition for their identification, but not the sufficient one: indeed, also both SDPSK and OQPSK modes exhibit two spectral lines in the second harmonic. Please note that the carrier in the fourth degree is very weakly expressed, sometimes it is practically invisible at all.

Fig. 3

That said, as shown in Figure 4, some equalization/autocorrelation is necessary to bring out the carrier (a) so that the SA demodulator PLL can lock onto it: this way you have a clearer view of phase plane and constellations. The 4-ary constellation (b) and its transitions pattern (c) rule out the OQPSK mode (and GMSK too) since it should show an 8-ary like constellation but w/out zero-crossing transitions. The relative/differential view (Diff=1) show instead a two-state mode (d,e).
The above considerations suggest SDPSK (Simmetrical Diferential PSK) modulation, just like the one used for Orbcomm series sats [2]. Moreover, note the "Offset mode detected" warning that means a relative phase shift keying, aka offset keying! Indeed SDPSK is equivalent to π/2 DBPSK or PSK2 with phase rotation: ie, as shown by the transitions in absolute mode (c), SDPSK assumes that the phase is rotated by +π/2 for bit “0” and by -π/2 for bit “1” thus there is not a 180° turn.

Fig. 4 - phase plane and constellation of the signal being analyzed

So, while the mathematical relations among Bw/Br/Sh point to a GMSK modulation, phase plane and constellations seem to point to a SDPSK (or even CPFSK) modulation: the relative phase planes and constellations are shown in Figure 5 (the SDPSK and CPFSK signals are synthesized).

Fig. 5 - phase planes and constellations of  (synthesized) SDPSK and CPFSK signals

However, the comparison between the phase detector results shows a behavior more similar to a GMSK signal (Figure 6).

Fig. 6 - phase detector results (CPFSK, SDPSK, our signal)

Since such kinds of signals can be demodulated also as FSK, I tried both the SA universal PSK and  FSK demodulaors: the resulting bitstreams are shown in Figure 8, as you can see they are the same (the 15-bit period is due to the initial preamble).

Fig. 7 - SA universal PSK and MFSK demodulators

Fig. 8 - bistreams after PSK and FSK demodulations 

To conclude, "There is a lot of information that proves that semi-modes are practically the same from a mathematical point of view but at the receiver side there is no a reliable and easy method to discern the exact type of modulation. However, if the signal has a good quality, there are some clues that can help tip the balance one way or another... even if they could be not the conclusive" my friend AngazU says.

https://disk.yandex.com/d/WwBwL6tD_CTwLw  (.wav signals and bistreams)

[1] http://signals.radioscanner.ru/info/item68/
[2] http://signals.radioscanner.ru/base/signal16/

19 April 2024

French AF AWACS comms using MS-110A

I recently recorded some transmissions of the French Air Force (FAF), more precisely traffic between the Boeing E-3F Sentry 202 aircraft (ALE address 202E3F) & its home, ie the E-3F Main Operating Base located at BA702 Avord airport (ALE address MOBE3F). These transmissions were recorded on the frequency of 6745.0 KHz/USB and almost all follow the same "format" visible in Figure 1: MS-141A used for automatic link setup (2G-ALE) followed by MS-110A segments used for sending data in (I think) ARQ mode.

Fig. 1 - an Air-To-Ground transmission from aircraft 202 & MOB ground base

The analysis of the bitstreams points out some interesting characteristics:

a) Figure 2 shows that three type of "messages" are used: longer messages such as 1 & 4 of Figure 1 - unlike the others - do not carry data and therefore they could have a sync or signaling function for the receiving side, say a "control" type messages? This type of message is present in all the transmissions I recorded and precedes the real "data" message which in its turn is followed by what I think be an "ACK" type message (for clarity, the bistream in the left part of Figure 2 is time-edited).

b) all message types (control, data, ACK) end with the same string 0x69D3D226 (I added the trailing "00" 100101101100101101001011011001[00] bits to get an hex string).

Fig. 2

c) all data messages have the same length and consist of initial phasing sequence followed by 92 bytes of data (Figure 3). This fixed format could mean sending standard or pre-formatted messages, however it is difficult to venture anything about the content of the messages other than the fact that it is largely Air-To-Ground traffic (from aircraft 202 to MOB).

Fig. 3 - "data" type messages

In particular, a Ground-To-Air transmission (from MOB to aircraft 202) turned out to be composed only of the short ACK type messages that apparently make no sense (Figs 4,5), a possible explanation is the failure to receive the messages sent by the aircraft... but it's just a my guess.

Fig. 4 - a Ground-To-Air transmission
 

Fig. 5 - bitstreams related to MS-110A transmissions of Fig. 4


https://disk.yandex.com/d/4Ba30b6k4-9cig

Armée de l'Air (French Air Force) Boeing E-3F Sentry 202

 

15 April 2024

unid datalink protocol(s) over a PSK8 ST and STANAG-4539 (2)

I had the opportunity to record other transmissions on 3712.70 KHz/USB and - also following the comment of my friend KarapuZ - I can state with reasonable certainty that the waveforms analyzed in the previous post [1] come from Thales equipment. 
As mentioned, both Thales and L3Harris use the GMSK-MFSK8 waveform to handle HF links but the L3Harris bitmap/bitstream have a very recognizable pattern that is not present in the bursts recorded today (Figs 1,2): therefore, the GMSK-MFSK-8 signal is the Thales Systeme-3000 "Skymaster ALE", used in TRC-3500 and TRC-3600/TRC-3700 series radios (HF 3000 family).

Fig. 1 - Thales Systeme-3000 GMFKS+MFSK8

Fig. 2 - Thales Systeme-3000 GMFKS: bitstream after differential decoding and 50ms bitmap

As you see in Figure 2, I used the OQPSK "view" to demodulate the preamble of the Skyaster ALE signal: however, the differential decoding clearly show a 2-state keying (precisely GMFSK) that can be demodulated also using the "classic" FSK approach (Figure 3).

Fig. 3 - use of the SA MFSK dem

For what concerns the two PSK8 Serial Tone waveforms A & B [1], they also could be proprietary ones (Thales); indeed, quoting TRC-3600 datasheet: "Thanks to its digital advanced technology, the TRC 3600 offers new embedded services: secure high data rate and digital voice transmissions. It integrates a high data rate, multiwaveform, single tone modem (from 75 to 5400 bps) and a vocoder (800 - 2400 bps) associated to a high security digital COMSEC chip". 

The data link protocol could be the digital voice vocoder (new MELP/LPC10), given the similarity of the bitstream with its L3Harris analogue, but that is just an unconfirmed hypothesis of mine.

Fig. 4 - bitmaps of the two PSK8 ST waveforms 

 https://disk.yandex.com/d/6NK6xYRAWzjzEw

 [1] http://i56578-swl.blogspot.com/2024/04/unid-datalink-protocols-over-psk8-st.html

9 April 2024

unid datalink protocol(s) over a PSK8 ST and STANAG-4539 (Thales? L3Harris?)

A few days ago I came across some transmissions that caught my attention for at least three good reasons:
1. the frequency used, i.e. 7312.7 KHz/USB, within the 42 meter broadcast band;
2. the use of different traffic waveforms, ie PSK8 serial Tone and STANAG-4539, in ARQ and non-ARQ modes. The ARQ mode is easily recognizable by the difference between the frequencies of the subcarriers (around 50Hz) of data and ACK segments (1);  

Fig. 1 - different traffic waveforms

3. the use of a waveform composed of GMFSK-2000Bd + MFSK8 for the link setup procedure (Figure 2): as far as I know, this particular waveform is used by both Thales and Harris. Notice that the MFSK8 part is 188-141A compatible (125Bd & 250Hz separation between the 8 tones) but use a diferrent tone library.

Fig. 2 - GMFSK + MSK8 link setup waveform

I had already met such transmissions, noting how the system was able to simultaneously demodulate 2/3 waveforms (or more if we consider the ALE exchanges) even during the same logical link. In these recordings a single waveform (PSK8 ST or S-4539) is mostly used and I took advantage of this to study the characteristics of the used datalink protocol; a protocol which - in my opinion and according to my analysis - turns out to be proprietary and quite complex.

PSK8 Serial Tone
Figure 3 shows the 8-ary constellation (states and transitions) as well as the rasters of the two PSK8 modulated waveforms A and B. In the phase states, and especially looking at the transitions, one can easily notice the presence of a PSK2 modulation which is certainly used for the synchronization sequences visible in the bitmaps below. As usual, the resulting PSK2 symbols are then mapped and scrambled to appear, on-air, as a PSK8 costellation. Bot the the waveforms have an ACF of 106.6 ms that makes a 256 PSK8 symbols frame at the modulation rate of 2400Bd. However, although of the same length, two different framings are adopted, in particular the Type B waveform uses a framing similar in composition to that of STANAG-4285. 
 
Fig. 3 - constellation and bitmaps of the PSK8 Serial Tone waveform

It is important to note both in the bitmaps of Figure 3 and in the demodulated bistream of Figure 4 (related to the Type A waveform) the presence of "regular" and similar patterns, as well as the "invariance" of the symbols of the synchronization sequences. In my opinion such patterns and sequences could indicate the use of a uncoded mode and even no interleaving (or 1 frame length interleaver), furthermore the length of the scrambler should coincide with that of the frame (256 symbols) or at least it should be initialized at the beginning of each frame (2).

Fig. 4 - PSK8 ST type "A" waveform: demodulated bitstream

Examining the symbols of the synchronization sequences offers further food for thought. In Type A waveform, the use of PSK2 modulation is confirmed by the 2-state transitions in the sync sequence, the latter consisting of a pseudorandom sequence of 31 symbols that is repeated twice for a total of 62 symbols (Figure 5).
 
Fig. 5 - sync sequence symbols, PSK8 type "A" waveform

Two state-transitions are also visible in the sync sequence of Type B waveform (Figure 6). Given its similarity to the S-4285 framing, the synchronization sequence consists of 80 symbols and it too is a pseudorandom sequence of length 31, which is repeated periodically within the 80-symbol window (2 periods of length 31 plus the first 18 symbols of another period).

Fig. 6 - sync sequence symbols, PSK8 type "B" waveform

The most interesting thing, apart from the state values which may be due to both the scrambler and the the possible phase-offset errors of the SA PSK demodulator (3), is that both the two Types of waveforms use the same 31-symbol sync sequence: indeed, as can be seen in Figure 7, the 2-state transitions are the same. Perhaps the length of the sync sequence is used by the receiving modem to figure out which of the two waveforms is incoming, but it's just a my guess.

Fig. 7 - sync sequence symbols, PSK8 type "B" and "A" waveforms

Since the Type B waveform has the same framing as S-4285, an S-4285 decoder recognizes the Type B waveform samples (100% confidence) but since the synchronization sequences are different (see the 2-state transitions in Figure 8) it does not successfully engage any sub-modes.
 
Fig. 8 - comparison between sync sequences of PSK8 Type "B"  and STANAG-4285

STANAG-4539
As per STANAG-4539, both the QAM16 and PSK8 waveforms have the same 287-symbol framing (119.6ms ACF, 2400Bd) although the user data rate is different: 6400bps and 3200bps respectively for QAM16 and PSK8.

Fig. 9 - constellations and bitmaps of STANAG-4539 QAM16 and PSK8 waveforms

If in the case of PSK8 ST it was only possible to analyze the symbols after demodulation, in the case of STANAG-4539 it is possible to decode the signals and then analyze the composition of the upper layer datalink protocol(s).
Figure 10 shows a detail of a bitstream obtained after removing the S-4539 QAM16 overhead and consists of 96-byte (768 bits) Protocol Data Units (PDUs), each PDU consisting of 3 bytes header followed by 93 bytes of data:
1st byte: a ID/value field, in this sample: 0x09 (LSB first)
2nd byte: down-counter field (LSB first)
3rd byte: up-counter field (LSB first)
As one can see looking at the values of the two counters in Figure 10, the sample consists of 55 PDUs, numbered from 0 (00000000) to 54 (00110110).

Fig. 10 - headers and part fo bitstream after S-4539 QAM16 decoding
 
The same fields' structure can be found in the PDUs extracted from a sample of STANAG-4539 PSK8 (Figure 11). Since the half of the user data rate (3200bps Vs 6400bps), each PDU consists of 48 bytes: 3 bytes for the header fields followed by 45 bytes of data. It's interesting to see that a change in the first field (from 01001000 (36) to 00001000 (8)) occurs when the down-counter field restarts its value after reaching the 0: curiously, the up-counter does not "reset" but continues its counting.
It's worth noting that that patterns highlighted in the bitstream of Figure 4 (and the bitmaps of Figure 3) are most likely the two counter fields of Figure 11: if so, both tPSK8 ST and S-4539 traffic waveform transport the same datalink PDUs.
 
Fig. 11 - headers and part fo bitstream after S-4539 PSK8 decoding
 
Even more interesting. After removing the 3 bytes of the headers, I reshaped the stream into a 128 bit scheme (16 bytes), i.e. to the most probable value of its period, and I noticed the repetition of the string 0x3CF04F; so I synced the stream on this value (Figure 12), fixing a minimum length of 128 bits. The result highlights the presence of 45 PDUs of a "secondary" datalink protocol where each PDU has an header consisting of 4 bytes and a minimum length of 16 bytes (128 bits), the maximum is over 600 bytes (I was not able to establish it accurately):
bytes 1-3: a ID/value field, [001111001111000001001111] 0x3CF04 (LSB first)
4th byte: up-counter field (LSB first)
 
Fig. 12 - the emerging "secondary" datalink protocol PDUs

This may be a hasty statement, but it seems that the "secondary" datalink protocol PDUs > 16 bytes length are fragmented into small segments and then incapsulated into the 45/95 bytes payload of the "primary" datalink protocol PDUs. By the way, at least in these samples, the "secondary" PDUs have been found only in the primary PDUs which have the first byte of the hedaer equal to 0x48, maybe just a mere coincidence (Figure 13,14).

Fig. 13

Fig. 14

comments
Since the lack of clear-text callsigns it's impossible to id the user, we may speculate just some guess about the manufacturer of the used devices:
 
- as far as I know both Thales and L3Harris make use of the GMSK-MFSK8 waveform to manage HF links: unfortunately the GMFSK signals portions are too short to allow the analysis of the bitmaps (L3Harris GMFSK has a well recognizable pattern [1]);

L3Harris typical pattern in GMFSK-MFSK8 signals

- the patterns highlighted in Figures 3,4 are very similar to the ones visible in the demodulated bitmaps of PSK8 Voice Digital waveform (L3Harris VD mode) [2];

L3Harris VD mode bitstream
- from Harris RF-5800 datasheet "L3Harris VD mode also allows data to be sent...both data and voice are secured with Citadel encryption" [2]: well, I did not find the Citadel characteristic pattern within the decoded bitstream, even if they could be plain-text transmissions.
 
So: Thales? L3Harris? either of them? ...hints and comments are welcome.
(to be continued)
 
 
(1)50Hz difference between 1800Hz sub-carriers
 

(2) FEC encoding and interleaving should provide time separation between contiguous values.

(3) SA is a signal analyzer and not a decoder, therefore its phase-plane demodulator does not sync  any particular protocol, as it happens for example in STANAG-4285 "suited" decoders. Working with phase keyed signals, the SA phane-plane demodulator produces right interpretations and views (number of phases, angles, modulation speed, carrier frequency,...) but it may return wrong demodulated streams due to the possible phase-offset errors.